The job of the syslog daemon is to collect logging messages from various processes/programs on the diskstation or from remote. Almost every application has the ability to send messages to a syslog daemon. Every message is sent to syslog, which then decides according to its configuration which messages to keep and which to drop (not writing to log files). Unfortunately the syslog daemon from Synology does not show very much of the messages it receives. Just the processing of one email creates more lines to syslog than the entiere boot-process to the Synology logs
That's why I wanted to install another log process and I found a quite easy way with the ipkg package syslog-ng

• ipkg (bootstrap) must be installed and working
• access to the shell (cli) via ssh or telnet as user root
• texteditor which can handle unix line-endings correctly like vi or nano on the DS or notepad++ on the client

syslog-ng is an ipkg package and must therefore be installed accordingly:

$ ipkg update
$ ipkg install syslog-ng

That should install all the necessary packages for syslog-ng. It's always a good idea to ipkg update before installing any package.

In order for the syslog-ng to start and run properly one has to prevent the synology log daemon from starting. The default daemon is referenced in the following two files:

• /etc/rc
• /etc/defaults/rc.conf

Lokk for the following lines

syslogd_enable="YES"
syslogd_flags="-S"
case ${syslogd_enable} in
[Yy][Ee][Ss])
# Transitional symlink (for the next couple of years :) until all
# binaries have had a chance to move towards /var/run/log.
if [ ! -L /dev/log ]; then
# might complain for r/o root f/s
ln -sf /var/run/log /dev/log
fi

rm -f /var/run/log
echo "Starting syslogd..."
${syslogd_program:-/sbin/syslogd} ${syslogd_flags}
/sbin/klogd
;;
esac

and set syslogd_enable=„NO“

Here you should look for the following lines

syslogd_enable="YES"
syslogd_program="/sbin/syslogd"
syslogd_flags=""

and set the value to „NO“

I tried once to keep the value at YES and set syslog-ng a program path. For a while it went well but after the 3rd or 4th reboot syslog-ng did not start anymore. That's why it's better to set NO and use a little shell startscript for syslog-ng

The startscript provided with ipkg syslog-ng is not fully correct. You should open its startfile (/opt/etc/init.d/S01syslog-ng)

#!/bin/sh
#
# Startup script for syslog-ng
#
 
# Stop itself if running
if [ -n "`pidof syslog-ng`" ]; then
/bin/killall syslog-ng 2>/dev/null
fi
 
sleep 2
 
/opt/sbin/syslog-ng -f

and replace the last line with

if [ "$*"='start' ] || [ "$*"='restart' ] ; then
 /opt/sbin/syslog-ng -f /opt/etc/syslog-ng/syslog-ng.conf
fi

Additionally ensure that execute-bit is set on this file and start it once for testing. If an error occurs the following might help you

Error binding socket; addr='AF_UNIX(/dev/log)', error='Address already in use (98)'
Error initializing source driver; source='src'

If you see the message above when starting the script then you could try the following:

$ cd /dev
$ ll log
lrwxrwxrwx 1 root root 12 Dec 9 08:25 log -> /var/run/log
$ rm log

After that my syslog-ng started well and logged everything like expected. All messages from syno processes which normally go to /var/log/messages will be written properly to /opt/var/log/messages from now on.

If you getting to many log files for mail then it's possible to merge several log files to one. Open /opt/etc/syslog-ng/syslog-ng.conf

destination mail { file("/opt/var/log/mail.log"); };
destination mailinfo { file("/opt/var/log/mail.log"); };
destination mailwarn { file("/opt/var/log/mail.log"); };
destination mailerr { file("/opt/var/log/mail.log"); };

with the code above all messages for the facilities mail, maininfo, mailwarn and mailerr will be written to the same file.